Privacy requests

Settings > Privacy is where your organisation answers requests from people about the information it holds about them: to see it, correct it, export it, erase it, or object to or restrict how it is used. You need permission to manage users to open it.

Each request has a due date 30 days after you received it, counted in your organisation's time zone. The Requests tab lists every request with the soonest due first, and marks a request that is past its due date and still open as Overdue.

Log a request

1. Go to Settings > Privacy.
2. Select New request.
3. Choose the Kind of request and when it was Received.
4. Select Log request. The request's page opens.

A request gets a reference such as dsr-7k3m9q2x. Don't record the person's name on the request: you find them on the request's page instead. If someone sends a request to Backed rather than to you, Backed passes it on and it appears in your list.

Confirm who they are

Before you send anyone their information, check they are who they say they are. Under Confirm who they are, choose How you checked, then select Record the check. The request shows who recorded the check and when.

Find the person

Under Find the person, search by Email address for an exact match, or by Name. Each person found is listed with their records, grouped by type. You see only the records you're allowed to see, and each group says how many more records you don't have access to. A person who gives to a fund is also found by their fund donor records, their grant recommendations and the donor report schedules they receive, which every Administrator who opens Settings > Privacy can see.

• Download personal data builds a file of the person's information. It takes a moment; when it is ready, a link to download it appears.
• On an erasure request, Erase this person shows what an erasure would change, delete and keep, and anything that stops it, such as the person being your organisation's last owner. Choose the free-text answers to erase, then type ERASE to confirm. Their name and contact details are replaced in your organisation's records; records you must keep to account for funding stay. Their account and their access to other organisations are not affected. The erasure's report appears under Erasure reports when it finishes.

Answer the request

1. Select Start working on it when you begin.
2. Under Decision, choose the Outcome. If you refuse the request or only partly grant it, choose the Reason for refusal.
3. Add a Note on what you decided and did, then select Complete request or Refuse request.

You can't complete a request until you have confirmed who the person is. If you couldn't confirm it, refuse the request with the reason Their identity could not be verified.

Subprocessor notices

The Subprocessor notices tab lists changes to the service providers that process your organisation's data for Backed. You need access to the organisation's settings to see it. To object to a change, select Object, say why, and select Send objection before the change takes effect. After that date, or once you have objected, Object is no longer available.

See also

• Security and privacy review
• Security settings